path: root/content/tech/nixos-mailserver.md

---
date: 2016-06-11
title: NixOS mail server
draft: true
---

<!--more-->
This is my working, but in progress [NixOS]({{< ref "nixos-intro.md" >}}) mail server configuration. These are the relevant configuration parts, they are *not* tested and **not guaranteed to be secure, deploy at your own risk**. The configuration is based on [this](https://thomas-leister.de/allgemein/sicherer-mailserver-dovecot-postfix-virtuellen-benutzern-mysql-ubuntu-server-xenial/) blog post (German).

For an easier overview, I created a seperate `mail.nix` that is included in the main `configuration.nix`. The firewall needs to be open for ports 993 (imps), 25 (smtp) and 587 (smtps).

```nix
imports =
  [
    ./mail.nix
  ];

networking.firewall.allowedTCPPorts = [ 993 25 587 ];
```

The server is built with postfix. Postfix transports the mail via smtp(s). Dovecot is the interface between user and provides pop3(s) and/or imap(s). Opendkim signs outgoing mail so that it is less likely to be marked as spam by other providers.

DNS records must be and a PTR record can be set up. This is not covered here.

It is advisable to use SSL certificates. NixOS has a module that gets Let's Encrypt certificates:

```nix
security.acme.certs = {
  "yourdomain.tld" = {
    webroot = "/var/www/challenges";
    extraDomains = { "mail.yourdomain.tld" = null; };
    email = "mail@provider.net";
    postRun = "systemctl reload nginx.service postfix.service dovecot2.service";
  };
};
```

A web server is needed for the certification process.

```nix
services.nginx = {
  enable = true;
  httpConfig = ''
    include ${pkgs.nginx}/conf/mime.types;

    server {
      listen 80;
      listen [::]:80;
      server_name mail.yourdomain.tld;
      location /.well-known/acme-challenge {
        root /var/www/challenges/;
      }
    }
  '';
};
```

After retrieving certificates once: `systemctl start acme-yourdomain.tld`, they will be regenerated regularly and placed in `/var/lib/acme/yourdomain.tld/` by default. Now comes the main configuration. The user `vmail` is the owner of the mailing system.

```nix
users.users.vmail = {
  home = "/var/vmail";
  createHome = true;
  group = "vmail";
};
users.groups = { vmail = {}; };
```

Dovecot requires an external configuration file. I put it in `/etc/nixos/mail/dovecot.conf`.

```nix
services.dovecot2 = {
  enable = true;
  configFile = "/etc/nixos/mail/dovecot.conf";
  sslCACert = "/var/lib/acme/yourdomain.tld/fullchain.pem";
  sslServerCert = "/var/lib/acme/yourdomain.tld/fullchain.pem";
  sslServerKey = "/var/lib/acme/yourdomain.tld/key.pem";
};
```

This is the dovecot config. It exposes imap, lmtp and auth ports. imap is for the user. lmtp and auth are for exchanging data between dovecot and postfix. Postfix will authenticate via dovecot. `passdb` and `userdb` set to `pam` and `passwd` will allow every local unix user to authenticate with their username and password. Each user has a `~/Maildir` with their mail, each mailbox contains the folders "Spam", "Trash", "Drafts" and "Sent".

```perl
default_internal_user = dovecot2

protocols = imap lmtp

ssl = required
ssl_cert = </var/lib/acme/yourdomain.tld/fullchain.pem
ssl_key = </var/lib/acme/yourdomain.tld/key.pem
ssl_dh_parameters_length = 2048
ssl_protocols = !SSLv2 !SSLv3
ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
ssl_prefer_server_ciphers = yes

service imap-login {
    inet_listener imap {
        port = 143
    }
}

service lmtp {
    inet_listener {
      port = 8458
    }
}


service auth {
    inet_listener {
        port = 2847
    }
}

protocol imap {
    mail_plugins = $mail_plugins
    mail_max_userip_connections = 20
    imap_idle_notify_interval = 29 mins
}

protocol lmtp {
    postmaster_address = postmaster@yourdomain.tld
    mail_plugins = $mail_plugins
}

disable_plaintext_auth = yes
auth_mechanisms = plain login

auth_username_format = %Ln
passdb {
    driver = pam
    args = dovecot2
}
userdb {
    driver = passwd
    args = blocking=no
}

mail_uid = vmail
mail_gid = vmail
mail_privileged_group = vmail

mail_home = /var/vmail/mailboxes/%d/%n
mail_location = maildir:~/Maildir

namespace inbox {
    inbox = yes

    mailbox Spam {
        auto = subscribe
        special_use = \Junk
    }

    mailbox Trash {
        auto = subscribe
        special_use = \Trash
    }

    mailbox Drafts {
        auto = subscribe
        special_use = \Drafts
    }

    mailbox Sent {
        auto = subscribe
        special_use = \Sent
    }
}
```

Now comes postfix. Postfix is configured to authenticate via dovecot. Postscreen and dnsblog filter some spam mails.

```nix
  services.postfix = {
    enable = true;
    user = "vmail";
    group = "vmail";
    domain = "mail.yourdomain.tld";
    hostname = "mail.yourdomain.tld";
    sslCACert = "/var/lib/acme/yourdomain.tld/fullchain.pem";
    sslCert = "/var/lib/acme/yourdomain.tld/fullchain.pem";
    sslKey = "/var/lib/acme/yourdomain.tld/key.pem";
    recipientDelimiter = "+";
    destination = [ "yourdomain.tld" "mail.yourdomain.tld" ];
    virtual = ''
onealias@yourdomain.tld youruser
anotheralias@yourdomain.tld youruser
    '';
    extraMasterConf = ''
smtp	inet	n	-	n	-	1	postscreen
	-o smtpd_sasl_auth_enable=no
smtpd	pass	-	-	n	-	-	smtpd
	-o smtpd_sasl_auth_enable=no
dnsblog	unix	-	-	n	-	0	dnsblog
tlsproxy	unix	-	-	n	-	0	tlsproxy
submission	inet	n	-	n	-	-	smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_sasl_type=dovecot
    -o smtpd_sasl_path=inet:127.0.0.1:2847
    -o smtpd_sasl_security_options=noanonymous
    -o smtpd_relay_restrictions=reject_non_fqdn_recipient,reject_unknown_recipient_domain,permit_mynetworks,permit_sasl_authenticated,reject
    -o smtpd_sender_restrictions=permit_mynetworks,reject_non_fqdn_sender,permit_sasl_authenticated,reject
    -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
    -o smtpd_helo_required=no
    -o smtpd_helo_restrictions=
    -o milter_macro_daemon_name=ORIGINATING
    -o cleanup_service_name=submission-header-cleanup
submission-header-cleanup	unix	n	-	n	-	0	cleanup
    -o header_checks=pcre:/etc/nixos/mail/anonymize_headers.pcre
'';
    extraConfig = ''
maximal_queue_lifetime = 1h
bounce_queue_lifetime = 1h
maximal_backoff_time = 15m
minimal_backoff_time = 5m
queue_run_delay = 5m

tls_ssl_options = NO_COMPRESSION
tls_high_cipherlist = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA
smtp_tls_security_level = dane
smtp_dns_support_level = dnssec
smtp_tls_session_cache_database = btree:''${data_directory}/smtp_scache
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_ciphers = high
smtpd_tls_security_level = may
smtpd_tls_protocols = !SSLv2, !SSLv3
smtpd_tls_ciphers = high
smtpd_tls_eecdh_grade = strong
smtpd_tls_dh1024_param_file=/var/lib/acme/yourdomain.tld/dhparams.pem
smtpd_tls_session_cache_database = btree:''${data_directory}/smtpd_scache

smtpd_relay_restrictions =
                                reject_non_fqdn_recipient
                                reject_unknown_recipient_domain
                                permit_mynetworks
                                reject_unauth_destination
smtpd_client_restrictions =     permit_mynetworks
                                reject_unknown_client_hostname
smtpd_helo_required = yes
smtpd_helo_restrictions =   permit_mynetworks
                            reject_invalid_helo_hostname
                            reject_non_fqdn_helo_hostname
                            reject_unknown_helo_hostname
smtpd_data_restrictions = reject_unauth_pipelining


mailbox_transport = lmtp:inet:127.0.0.1:8458

milter_default_action = accept
milter_protocol = 2
smtpd_milters = unix:/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/run/opendkim/opendkim.sock

# Postscreen
postscreen_access_list =        permit_mynetworks
postscreen_blacklist_action = drop
postscreen_greet_action = drop

# DNS blocklists
postscreen_dnsbl_threshold = 2
postscreen_dnsbl_sites = dnsbl.sorbs.net*1, bl.spamcop.net*1, ix.dnsbl.manitu.net*2, zen.spamhaus.org*2
postscreen_dnsbl_action = drop

# turn off biff notifications for performance
biff = no

append_dot_mydomain = no
    '';
};
```

`/etc/nixos/mail/anonymize_headers.pcre` replaces sensitive header data.

```
/^\s*(Received: from)[^\n]*(.*)/ REPLACE $1 [127.0.0.1] (localhost [127.0.0.1])$2
/^\s*User-Agent/        IGNORE
/^\s*X-Enigmail/        IGNORE
/^\s*X-Mailer/          IGNORE
/^\s*X-Originating-IP/  IGNORE
```

Finally, the opendkim configuration. Generate a key once with `opendkim-genkey -r -d yourdomain.tld`. Add the public key as DNS record.

```nix
services.opendkim = {
    enable = true;
    domains = "yourdomain.tld,mail.yourdomain.tld";
    keyFile = "/etc/nixos/mail/key.private";
    selector = "key";
    socket = "local:/run/opendkim/opendkim.sock";
    user = "vmail";
    group = "vmail";
};
```